CODEWITHSUNDEEP
phpwindowsexec
Strawberry
Strawberry

Reputation: 33945

Possible permissions issue when using exec commands in PHP

We have a small office intranet, built in PHP (on an apache server - so WAMP), that allows us to create project folders on our file server. This works by copying a set of template folders to a new location using the shell exec xcopy command and the following switches /e /k /i /c.

We (fairly) recently upgraded to a new file server running Windows Server 2008 R2 Standard. Now the xcopy command no longer works from within PHP. However, I know that the xcopy command is correct because it works if I copy and paste it into a command prompt (on the same machine).

I can see no error message but I assume this is some kind of permissions issue related to the PHP 'user', but I don't know exactly what or how to solve it.

The apache server and the file server are two separate machines. If it's relevant, the apache server is a 32bit machine and the file server is a 64bit machine but, as I say, I can invoke the xcopy command from the CLI of the 32bit machine without a problem.

The Apache process user name is SYSTEM (although I can't seem to use the 'whoami' command to check this)

Any pointers would be greatly appreciated.

FWIW, the exec string looks like this...

echo "xcopy \"\\\\path\\to\\folder\\xxxx_Project\\*.*\" \"\\\\path\\to\\folder\\9876_NEWPROJECT\" /e /k /i /c";

which (I think) materializes as this...

xcopy "\\path\to\folder\xxxx_Project\*.*" "\\path\to\folder\9876_NEWPROJECT" /e /k /i /c

Obviously, the '9876_NEWPROJECT bit is really a variable.

Upvotes: 1

Views: 12158

Answers (2)

Strawberry
Strawberry

Reputation: 33945

OK. I seem to have got it working. Here's what I did - tell me if it's a bad idea although I should point out that this is an intranet so I'm a little less concerned about security...

  1. Go to Control Panel->Administrative Tools_>Services

  2. Select the Apache service and hit Properties

  3. On the Log On tab, click 'This account:' instead of 'Local System account', and then find the User account of Windows user who's normally logged on to that terminal

  4. Restart Apache

I also amended the user info in the httpd.conf file, but I'm not actually certain that that was necessary.

If there's a better solution, that can be explained in words of two syllables or less, I'm all ears!

Upvotes: 6

RandomSeed
RandomSeed

Reputation: 29769

get_current_user() will confirm the user your script runs as.

Then try to manually execute your command as this user with runas (or if your user really is SYSTEM then you will need something like psexec to do so).

Now, assuming that your script actually runs as SYSTEM, it is very likely that this user is not authorised on the remote file server. I don't think it is even possible to do that (except, perhaps, by allowing "Everyone"). If it is, I am not sure this is a good idea anyways.

I would instead run the apache service as a regular user, and on the file server, grant access to this user.

Alternatively, you could mount the remote location as a network drive (not tested, other answers in the thread might help too).

Upvotes: 5

Related Questions